Re: [PATCH] md/raid5: set conf->mddev before the first setup_conf() error path

[Logan Gunthorpe <logang@deltatee.com>]

On 2026-10-04 00:02, Yogesh Gaur wrote:
> free_conf() starts with log_exit(), which falls through to
> raid5_has_ppl() when conf->log is NULL:
> 
> 	static inline void log_exit(struct r5conf *conf)
> 	{
> 		if (conf->log)
> 			r5l_exit_log(conf);
> 		else if (raid5_has_ppl(conf))
> 			ppl_exit_log(conf);
> 	}
> 
> raid5_has_ppl() reads conf->mddev->flags. setup_conf() only assigns
> conf->mddev after bioset_init(), but five of its error paths -- the
> pending_data, alloc_thread_groups(), conf->disks, extra_page and
> bioset_init() failures -- jump to "abort:" before that, and abort: calls
> free_conf(). conf comes from kzalloc, so conf->mddev is still NULL and
> free_conf() dereferences it:
> 
> 	BUG: KASAN: null-ptr-deref in raid5_has_ppl drivers/md/raid5-log.h:54 [inline]
> 	BUG: KASAN: null-ptr-deref in log_exit drivers/md/raid5-log.h:128 [inline]
> 	BUG: KASAN: null-ptr-deref in free_conf+0x81/0x5d0 drivers/md/raid5.c:7549
> 	Read of size 8 at addr 0000000000000028 by task syz.3.20/5681
> 	Call Trace:
> 	 <TASK>
> 	 free_conf+0x81/0x5d0 drivers/md/raid5.c:7549
> 	 setup_conf+0x1720/0x2ad0 drivers/md/raid5.c:7885
> 	 raid5_run+0x8cc/0x2560 drivers/md/raid5.c:8129
> 	 md_run+0xc3d/0x1cd0 drivers/md/md.c:6779
> 	 do_md_run+0x35/0x720 drivers/md/md.c:6880
> 	 array_state_store+0x958/0xe90 drivers/md/md.c:-1
> 	 </TASK>
> 
> The faulting address is offsetof(struct mddev, flags).
> 
> conf->mddev is a back pointer that is constant for the lifetime of the
> conf and does not depend on anything computed in between, so assign it
> as soon as the conf is allocated. Nothing between the allocation and the
> old assignment reads conf->mddev -- alloc_thread_groups() takes the conf
> but never looks at its mddev, and the rdev_for_each() loop walks the
> mddev argument directly.
> 
> All five paths are allocation failures, so this needs memory pressure or
> fault injection to hit, which is how syzbot found it.
> 
> Reported-by: syzbot+270624bb31d478afe62e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=270624bb31d478afe62e
> Fixes: ff875738edd4 ("raid5: separate header for log functions")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>

Looks good to me, thanks!

Reviewed-by: Logan Gunthorpe <logang@deltatee.com>

Logan